Executive brief
Etherpad's import and export functions generate temporary file paths using JavaScript's Math.random() function, which produces only ~32 bits of entropy and is predictable. An attacker with local access to a shared system (like a multi-tenant server or Kubernetes node) can predict these paths, create a symlink to a sensitive file, and trick Etherpad into overwriting that file. This is particularly dangerous if Etherpad runs with elevated privileges (such as root in a Docker container), potentially allowing the attacker to modify system configuration files or other sensitive data.
Technical details
The vulnerability exists in src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts, which compute temporary file paths using Math.floor(Math.random() * 0xFFFFFFFF). Math.random() is cryptographically insecure and yields only ~32 bits of entropy; furthermore, V8 shares PRNG state between consecutive calls, making the sequence predictable to an attacker who observes earlier temp-file names. These paths are written to os.tmpdir() (typically /tmp on Linux), a shared world-writable directory. An unprivileged local attacker can pre-create a symlink at a predicted path pointing to any file the Etherpad process can write. When ExportHandler or ImportHandler write to the temp path, the open syscall follows the symlink and overwrites the linked target. For deployments where Etherpad runs as a privileged user (root in Docker, certain snap configurations, or custom systemd units), this becomes arbitrary file overwrite. The import path is especially impactful because the attacker can partially control the content written via the post-conversion output of an uploaded document. The fix, deployed in commit 8c6104c (v3.1.0+), replaces Math.random() with crypto.randomBytes(16).toString('hex'), providing 128 bits of CSPRNG entropy.
Affected products
- Etherpad ep_etherpad-lite <= 3.0.0
Timeline
- 2026-08-13: disclosed: GHSA-2jwf-f4xq-f24h published on OSV and GitHub Security Advisory
- 2026-05-17: patched: Fix deployed in commit 8c6104c (PR #7784), included in ep_etherpad-lite v3.1.0+